controller
What It Means
A controller is the organization or person who decides what personal data to collect, why to collect it, and how to use it. Think of it as being the 'decision maker' who sets the rules for handling people's personal information, rather than just following someone else's instructions.
Why Chief AI Officers Care
As a CAIO, your AI systems likely process personal data, making your company the controller responsible for GDPR compliance, including obtaining proper consent, handling data subject requests, and ensuring lawful processing. Being misclassified as a processor when you're actually a controller exposes you to significant regulatory fines and legal liability.
Real-World Example
When Netflix decides to collect viewing history data to power its recommendation AI system, Netflix is the controller because they determined what data to collect and why. However, if Netflix hires AWS to simply store that data following Netflix's specific instructions, AWS would be a processor, not a controller.
Common Confusion
Companies often think they're just a 'processor' when they're actually the controller, especially when using third-party AI services or cloud platforms. The key distinction is who makes the strategic decisions about the data, not who physically handles it.
Industry-Specific Applications
See how this term applies to healthcare, finance, manufacturing, government, tech, and insurance.
Healthcare: In healthcare, the controller is typically the healthcare organization (hospital, clinic, or health system) that determi...
Finance: In finance, a controller is typically the financial institution, fintech company, or asset manager that determines the p...
Premium content locked
Includes:
- 6 industry-specific applications
- Relevant regulations by sector
- Real compliance scenarios
- Implementation guidance
Technical Definitions
NISTNational Institute of Standards and Technology
"‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;"Source: GDPR
Related Terms
Discuss This Term with Your AI Assistant
Ask how "controller" applies to your specific use case and regulatory context.
Start Free Trial